In-band identity verification and man-in-the-middle defense

• US 9,716,714 B1
• Filed: 12/15/2016
• Issued: 07/25/2017
• Est. Priority Date: 06/27/2014
• Status: Active Grant

• Current Assignee: Wickr Inc. (Amazon.com, Inc.)
• Original Assignee: Wickr Inc. (Amazon.com, Inc.)
• Inventors: Statica, Robert, Coppa, Kara Lynn, Howell, Christopher A.
• Primary Examiner(s): Avery, Jeremiah
• Application Number:
  US15/381,052
• Time in Patent Office: 222 Days
• Field of Search: None
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06T 11/60 Editing figures and text; Combining figures or text
• CPC Class Codes: G06V 40/1365 Matching; Classification
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

A variety of techniques for performing identity verification are disclosed. As one example, a verification request is received from a remote user. The verification request pertains to a cryptographic key. In response to receiving a confirmation from a local user of the local device, a verification process is initiated. A result of the verification process is transmitted to the remote user. As a second example, a verification request can be received at the local device, from a local user of the device. A verification process with respect to the local user is initiated, and a result of the verification process is transmitted to a remote user that is different from the local user.

Claims

1. A method, comprising:

receiving, at a local device, a verification request from a remote user in conjunction with a contact made by the remote user with a local user, wherein the verification request includes a request for a representation of a cryptographic hash value of a cryptographic key of the local user;

in response to a confirmation received from the local user of the local device, initiating a verification process, wherein the verification process includes capturing audiovisual content by the local device and the audiovisual content includes the representation of the cryptographic hash value; and

transmitting a result of the verification process to the remote user.

2. The method of claim 1 wherein the verification request comprises a fingerprint verification.

3. The method of claim 1 wherein the verification process includes displaying a script to the is local user.

4. The method of claim 3 wherein the script includes a dynamic element.

5. The method of claim 4 wherein the dynamic element includes at least one of a date and time.

6. The method of claim 4 wherein the dynamic element includes a representation of a fingerprint.

7. The method of claim 6 wherein the fingerprint corresponds to a public key associated with the local user.

8. The method of claim 1 wherein the result, when viewed by the remote user, includes an audiovisual component and an overlay component.

9. The method of claim 8 wherein the overlay component includes a representation of a fingerprint.

10. The method of claim 8 wherein the overlay component is provided by a device used by the remote user to view the result.

11. The method of claim 1 wherein the verification request is received from the remote user in conjunction with a first contact made by the remote user with the local user.

12. A method, comprising:

receiving at a local device, in conjunction with a contact made by a remote user with a local user, content purporting to establish an identity of the remote user at a remove device, wherein the content includes an audiovisual component that includes a representation of a cryptographic hash value of a cryptographic key of the remote user;

displaying, to the local user, the received content; and

recording an authentication verdict provided by the local user in conjunction with reviewing the received response, wherein an indication of the verdict is provided to the remote user in a messaging interface.

13. The method of claim 12 wherein displaying the received response includes displaying an overlay component.

14. The method of claim 13 wherein the overlay component includes a representation of a fingerprint.

15. The method of claim 14 wherein the fingerprint is associated with the remote user.

16. The method of claim 12 wherein the system is configured to transmit the verdict to a remote server.

17. A non-transitory computer-readable medium comprising instructions that when, executed by at least one hardware processor, perform the steps of, comprising:

receiving, at a local device, a verification request from a remote user in conjunction with a contact made by the remote user with a local user, wherein the verification request includes a request for a representation of a cryptographic hash value of a cryptographic key of the local user;

in response to a confirmation received from the local user of the local device, initiating a verification process, wherein the verification process includes capturing audiovisual content by the local device and the audiovisual content includes the representation of the cryptographic hash value; and

transmitting a result of the verification process to the remote user.

18. A non-transitory computer-readable medium comprising instructions that when, executed by at least one hardware processor, perform the steps of, comprising:

receiving at a local device, in conjunction with a contact made by a remote user with a local user, content purporting to establish an identity of the remote user at a remove device, wherein the content includes an audiovisual component that includes a representation of a cryptographic hash value of a cryptographic key of the remote user;

displaying, to the local user, the received content; and

recording an authentication verdict provided by the local user in conjunction with reviewing the received response, wherein an indication of the verdict is provided to the remote user in a messaging interface.